cve/2018/CVE-2018-16763.md

### [CVE-2018-16763](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16763)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.

### POC

#### Reference
- http://packetstormsecurity.com/files/153696/fuelCMS-1.4.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/153696/fuelCMS-1.4.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/160080/Fuel-CMS-1.4-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/160080/Fuel-CMS-1.4-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/164756/Fuel-CMS-1.4.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/164756/Fuel-CMS-1.4.1-Remote-Code-Execution.html
- https://0xd0ff9.wordpress.com/2019/07/19/from-code-evaluation-to-pre-auth-remote-code-execution-cve-2018-16763-bypass/
- https://0xd0ff9.wordpress.com/2019/07/19/from-code-evaluation-to-pre-auth-remote-code-execution-cve-2018-16763-bypass/
- https://www.exploit-db.com/exploits/47138
- https://www.exploit-db.com/exploits/47138

#### Github
- https://github.com/0xT11/CVE-POC
- https://github.com/1337kid/Exploits
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/BhattJayD/IgniteCTF
- https://github.com/BrunoPincho/cve-2018-16763-rust
- https://github.com/Elsfa7-110/kenzer-templates
- https://github.com/NaturalT314/CVE-2018-16763
- https://github.com/SlizBinksman/THM-Vulnerability_Capstone-CVE-2018-16763
- https://github.com/VitoBonetti/CVE-2018-16763
- https://github.com/anquanscan/sec-tools
- https://github.com/antisecc/CVE-2018-16763
- https://github.com/c0d3cr4f73r/CVE-2018-16763
- https://github.com/crypticdante/CVE-2018-16763
- https://github.com/d4n-sec/d4n-sec.github.io
- https://github.com/dinhbaouit/CVE-2018-16763
- https://github.com/ecebotarosh/CVE-2018-16763-exploit
- https://github.com/hikarihacks/CVE-2018-16763-exploit
- https://github.com/ice-wzl/Fuel-1.4.1-RCE-Updated
- https://github.com/jordansinclair1990/TryHackMeIgnite
- https://github.com/jtaubs1/Fuel-1.4.1-RCE-Updated
- https://github.com/k4is3r13/Bash-Script-CVE-2018-16763
- https://github.com/k4u5h41/CVE-2018-16763
- https://github.com/kxisxr/Bash-Script-CVE-2018-16763
- https://github.com/merlinepedra/nuclei-templates
- https://github.com/merlinepedra25/nuclei-templates
- https://github.com/n3m1dotsys/CVE-2018-16763-Exploit-Python3
- https://github.com/n3m1dotsys/n3m1dotsys
- https://github.com/n3m1sys/CVE-2018-16763-Exploit-Python3
- https://github.com/n3m1sys/n3m1sys
- https://github.com/n3ov4n1sh/CVE-2018-16763
- https://github.com/neharidha/Vulnerability-Capstone
- https://github.com/noraj/fuelcms-rce
- https://github.com/not1cyyy/CVE-2018-16763
- https://github.com/p0dalirius/CVE-2018-16763-FuelCMS-1.4.1-RCE
- https://github.com/padsalatushal/CVE-2018-16763
- https://github.com/savior-only/javafx_tools
- https://github.com/shoamshilo/Fuel-CMS-Remote-Code-Execution-1.4--RCE--
- https://github.com/sobinge/nuclei-templates
- https://github.com/uwueviee/Fu3l-F1lt3r
- https://github.com/wizardy0ga/THM-Vulnerability_Capstone-CVE-2018-16763